Page 1 of 9

PENNSYLVANIA ACTIONABLE INTELLIGENCE BULLETIN #67
TARGETED ACTIONABLE MONITORING CENTER 2 APRIL 2010

******
The Institute of Terrorism Research and Response (ITRR) produces this document specifically for the Pennsylvania Office of Homeland Security in support of public and private sector, critical infrastructure protection initiatives and strategies. The ITRR, a commercial research and analysis organization, uses open-source, human, and closedsource intelligence resources to derive products. ITRR used only native-tongue researchers (English, Hebrew, French, Arabic, and Spanish) in the collection, interpretation, translation, analysis and production of this product. The analysis is performed by former law enforcement officials, counter-terrorism experts, and military intelligence personnel. Consider in context with other known information.

STRATEGIC ANALYSIS
1. The Coordinated Attack - Unique Dangers
A terrorist tactic has been emerging over the past two years - the coordinated attack. The coordinated attack can be defined as a number of coordinated terrorist teams attacking a number of separate targets simultaneously, or within a short space of time, within the same zone of operations. Such an attack is usually planned in such a way as to maximize the confusion created by the multiplicity of targets and to compel the security forces of the affected zone to split their forces in order to simultaneously confront a number of threats in different locations. Two other elements that emerged in a number of coordinated attacks were the high level of fighting prowess displayed by the terrorists and their mission-specific weaponry and munitions. Though these are not necessary facets of a coordinated attack, they are usually evident because coordinated attacks take longer to prepare and terrorist organizations have more of a stake invested in their success. The existence of a number of terrorist teams within the same zone of operations can sometimes enable one team to come to support another during an assault or siege phase. Finally, the teams participating in the attack can, in many cases, coordinate their attacks with each other or with their operators after the fighting has already commenced. This can be accomplished with cell phones or other communication devices, such as satellite phones, walkie-talkies or two-way radios. The coordinated attack thus has innate advantages. The multiplicity of its focal points and the force of the surprise created by numerous attacks make it much harder for security forces to contain and neutralize the incident. The sense of uncertainty created by numerous attacks
Targeted Actionable Monitoring Center 2 April 2010

Page 2 of 9

makes for captivating media coverage, thus bringing the terrorist attack to the attention of television viewers the world over. Notable attacks which fall under our definition are the attack on the city of Mumbai, India, on 26-29 November 2008 (the Mumbai Massacre); the Taliban attack on the Ministries of Justice and Education and the Directorate of Prisons, located in Kabul, Afghanistan, on 11 February 2009; several attacks on rail lines, trains and trains stations by large cells of Naxalite separatist insurgents in India, and a 30 March 2010 assault by dozens of drug cartel gunmen, involving seven separate attacks, including three blockades, on two army bases in northern Mexico. Any major city, including those of the United States, can be the focus of similar coordinated attacks - provided the adversarial teams are able to carry out significant pre-operational intelligence collection. Thus, a strong presence of alert security forces can dissuade terrorist organizations from mounting such an attack altogether. However, even if the terrorist group decides to press ahead despite the presence of security forces, the adversarial agents collecting pre-operational intelligence run a greater risk of being recognized and apprehended. Targets of a coordinated attack generally have symbolic value. Thus, facilities such as government buildings, important hotels, foreign embassies and consulates and foreign agencies should be well protected by personnel who are familiar with the traits of a coordinated attack. Guards in civilian attire, as well as uniformed guards, should be used in the interest of picking up on pre-operational surveillance and probing. Shop owners, vendors and businessmen in the vicinity of potentially targeted assets on a regular basis should be discreetly questioned and provided with contact information, so they might speedily alert security forces upon noticing anything out of the ordinary. It is critical that both security personnel and key civilians be made sensitive to behaviors indicating pre-operational surveillance by adversarial elements, as well as related probing and active terrorist actions. This heightened awareness can be an indispensable counterterrorist force multiplier.

Targeted Actionable Monitoring Center 2 April 2010

Page 3 of 9

SECTOR-SPECIFIC THREATS, INDICATORS AND/OR WARNINGS
Sectors: GOVERNMENT FACILITIES; EMERGENCY SERVICES 2. Reaction to Hutaree Militia Arrests
As noted in PAIB no. 65, ITRR domestic terror analysts were expecting hostile reactions to the FBI sweep of nine Hutaree militia members. The charges against the Hutaree group include revelations that they planned to kill police officers and then bomb the subsequent funerals, followed by staging armed sieges complete with explosive perimeter IEDs and similar ordinance. Subsequent radical militia communications have borne out the ITRR analysis that "radical militias and other anti-government groups are likely to understand the arrests as part of a larger government plan targeting their associations." Examples include: * A quoted and reposted reaction by militia member on related forums: "[The FBI raids are] an escalation [towards conflict] by anyone's measure. ...My position is that we need to stick by those who have been attacked by our common enemy, and leave out any attempts to justify or vilify whatever they might have been up to before the attack." * A well-known online underground broadcast personality in the militia movement called law enforcement involved in the arrests "green-uniformed parasite bottom feeders". He also denounced what he referred to as "sealed warrants" as not constituting warrants at all, suggesting that there are people who will react to a sealed warrant with gunfire. He further suggested the Hutaree militia arrests were a set-up, and made references implying a parallel with the massive BATF assault on the Branch Davidian compound in Waco, Texas. * Another reaction to the arrests in a militia communication: "Everybody keep sharp and.... you know, we didn't start this mess." ******ANALYSIS****** T/l/W Rating: MODERATE

In the wake of the Hutaree arrests and the predictable reaction to them, including the ramping up of extremist rhetoric warning of an approaching tyranny, ITRR analysts have expressed concern over the increased likelihood of violent armed confrontation between members of a militia or other radical anti-government organization. Such a confrontation may even begin with a relatively minor altercation between armed anti-government individuals and law enforcement officers. ITRR researchers are currently monitoring militia and radical anti-government communications for shared adversarial intelligence or targeting indicators.

Targeted Actionable Monitoring Center 2 April 2010

Page 4 of 9

Sectors: COMMERCIAL FACILITIES; GOVERNMENT FACILITIES 3. Tea Party Events: Anarchist Reactions
A new anarchist communication includes a call to "crash the tea parties" slated for various locations around the country on 15 April 2010, including a major rally in Washington, DC. The call quickly generated a buzz among both anarchist and Tea Party supporters, with elements of both groups seemingly looking forward to the impending confrontations. The original anarchist communication calls Tea Party protesters "a coalition of conservatives, anti-Semites, fascists, libertarians, racists, constitutionalists, militia men, gun freaks, homophobes, Ron Paul supporters, Alex Jones conspiracy types and American flag wavers." It goes on to warn that "there is a big chance they will dominate this country in the near future." The communication presents several options for reaction to the Tea Party phenomenon, including: "Organize counter-protests against the tea party demonstrations, same time, same place. This is probably the best option. We need to get in the streets on April 15th and show the tea party movement that there are lots of people out there who oppose their agenda." Anarchist reaction has included everything from carefully considered warnings against alienating the Tea Party supporters with offensive disruptions to threatening statements like, "Right wing scum your time has come" and "Shut them down and drive them out of town". Some anarchists suggested infiltrating the protests dressed as "one of them" to peacefully spread anarchist ideology, while others felt that non-confrontational "counter-protests" will not be enough, preferring to encourage "anti-fascist direct action". One such "direct action" supporter added, "Don't kid yourself into thinking that rational discourse will enlighten these people.... These yahoos are the USA's version of the [far-right] National Front boneheads - it would be wise to act accordingly." In the United Kingdom and elsewhere, ITRR researchers point out, there have been physical street battles between members of various National Front organizations and anarchist anti-fascists. In response to the anarchist call, many individual Tea Party supporters have called for anarchists to "bring it on". One organization, Patriots For America (PFA), issued an alert regarding the planned "party crashing", saying, "[We] encourage all to exercise our freedom to express our voices.......it's the American thing.....and just like Gathering of Eagle did in March 2007, we ran the rabble out of town....." (long ellipses in the original). PFA added a cautionary note, as well: "take no offensive violent action against the left......defend each other but take no offensive action......" An additional anarchist communication, pivoting off the call for Tea Party "crashers", noted that well-known conservative pundit Sean Hannity ("one of the main ringleaders of this racist, fascist movement", according to the communication) is hosting a nationwide tour called "Taking Our Country Back". The anarchist added: "You know what that means in terms of them building their racist and fascist movement." He went on to note that the next tour date is 10 April 2010 in Kansas City. *******ANALYSIS****** T/I/W Rating: MODERATE

Targeted Actionable Monitoring Center 2 April 2010

Page 5 of 9

ITRR analysts expect the Tea Party events to conform to conditions of a legal protest (although ITRR has no current information regarding needed police permits). However, as noted in PAIB no. 65, confrontations between Tea Party protesters and their opponents may escalate into physical conflict. ITRR analysts believe that likelihood has increased significantly with the added element of an anarchist counter-protest campaign underway at this time. Furthermore, a small chance exists that more radical anti-government elements will be inspired to "direct action" targeting government offices. Also as noted in PAIB no. 65, ITRR researchers have collated details on most of the 15 April 2010 Tea Party events currently planned for Pennsylvania venues. These potential flashpoints of conflict between protesters and anarchists include: * In Harrisburg, the local Tea Party Patriots are calling for a rally at the State Capitol building or at the offices of local Congresspeople. * Phoenixville will host the rally organized by the Valley Forge Patriots at the intersection of Bridge and Main Streets. * DuBois City Park, Cherry Amphitheater, will host a "Freedom Rally" called by Pennsylvania Freedom Fighters. * In Montrose a Northeast Pennsylvania Spirit of 1776 rally will be held on The Green. * In Hollidaysburg, the Blair County Tea Party will be rallying at the city courthouse. * In Hanover, Wirt Park will be hosting a Tea Party rally. * In Honesdale, Constitutional Liberty Equals American Rights will be rallying in the city's Central Park. * The Shippensburg University College Republicans have called for a rally at the university's roller hockey rink. * In Lewistown, the Mifflin County 9-12 Project is planning to rally at the corner of S. Main Street and Elizabeth Street. * In Kennett Square, the Coalition for Advancing Freedom is planning a rally outside the VFW Post #5467. * Avondale will host a parallel rally of the Coalition for Advancing Freedom at the corner of State Street & Route 41. * In Oxford, another branch of the Coalition for Advancing Freedom is planning to rally in Oxford Town Center. * In Cochranville as well, the rally at the intersection of Route 41 and Route 10 has been called by the Coalition for Advancing Freedom. * In Jennersville, the Coalition for Advancing Freedom is planning to rally at the intersection of Route 796 and Old Baltimore Pike. As previously noted in PAIB no. 61, several organizations generally associated with the "Tea Party movement" are taking part in a 23-state caravan and series of rallies from Nevada to Washington DC, concluding in the capital on 15 April 2010 for a major Tea Party demonstration. That caravan is slated to arrive in Erie, Pennsylvania, on 11 April 2010 for a Tea Party rally. Related Tea Party events in Pennsylvania scheduled for April include: a rally in York on 10 April 10, at 1 East Market St.; a rally in Greensburg on 17 April, at the Greensburg-Jeannette Regional Airport, Claridge; and a rally in Mercer on 24 April, outside the Mercer County Courthouse (100 N Diamond St.).

Targeted Actionable Monitoring Center 2 April 2010

Page 6 of 9

There are no Pennsylvania dates for Sean Hannity's current talk show tour, as of this writing.

Sectors: COMMERCIAL FACILITIES; ENERGY; DAMS; TRANSPORTATION SYSTEMS; COMMUNICATIONS 4. Islamic Emirate of Afghanistan and the Infrastructure Threat
A fresh jihadist communication intercepted by ITRR researchers includes a re-release of a January 2010 statement from the Islamic Emirate of Afghanistan (IEA) that may be seen as an implied threat to Western infrastructure assets, as well as a direct threat to Christians in Afghanistan. The IEA statement accuses the Western powers of appropriating "all strategic assets of a country, including telecommunication, dams, transportation, mines, etc." After claiming that the Western powers are engaged in killing off Muslim intellectual leadership and plundering Muslim nations' natural resources, the communication turns to the presence of "Christian missionaries". According to the IEA, "colonialist powers send their religious groups, in this case, Christian missionaries to the occupied societies like Iraq and Afghanistan to convert Muslims to Christianity because they believe that the converted people honestly work for their political, economic and religious goals." *******ANALYSIS****** T/I/W Rating: MODERATE

ITRR analysts see the jihadist decision to again, within the space of about two months, release the above statement as relatively significant. Within Afghanistan A factor in the decision to focus on the Christian presence in Afghanistan at this time may well have been the Easter holiday. Afghanistan is still to be considered a volatile war zone, off-limits to travel. All personnel in Afghanistan involved in projects backed by Christian NGOs, as well as any schools or other projects originating in majority-Christian states, are advised to maintain effective force protection measures. According to ITRR analysts, churches or facilities used as Christian houses of prayer in Afghanistan are at particular risk if they are known to draw Westerner civilians or service members. Within CONUS ITRR analysts believe that the Taliban, the IEA and Al-Qaeda all have the desire and intent to strike the United States. ITRR analysts see the focus on certain infrastructures - those which the IEA claimed the US has "plundered" - as indicative of possible targeting guidance or incitement. That is, the Al-Qaeda affiliates would consider a strike against any of the above-named infrastructures as a high-profile, high-priority attack. Even if not organized by the terrorist group itself, the repeated emphasis in such "analysis" communications may influence lone-wolf or leaderless cells in terms of targeting.

Targeted Actionable Monitoring Center 2 April 2010

Page 7 of 9

More explicitly, shortly after the IEA statement was re-issued, Nigeria's Islamist Boko Haram organization (who has claimed allegiance to Al-Qaeda) stated, "We will carry out operations anywhere in world...." The communication added that the United States is the "number 1 target for its oppression and aggression against Muslim nations, particularly in Iraq and Afghanistan, and its blind support for Israel." ITRR analysts note that there have been recent and repeated calls in jihadist communications for Muslim Americans to follow in the footsteps of such lone-wolf jihadists as the Ft. Hood shooter, Nidal Hassan, and others. In this regard, terrorist communications discussing the possibility of future attacks, initially cited in PAIB no. 27, target mass transit assets or hubs. Vulnerable Pennsylvania assets include those of Amtrak, SEPTA, PAT, and the Philadelphia and Pittsburgh airports.

No actionable intelligence at this time for the following sectors:

AGRICULTURE AND FOOD DEFENSE INDUSTRIAL BASES HEALTHCARE AND PUBLIC HEALTH NATIONAL MONUMENTS AND ICONS BANKING AND FINANCE WATER CHEMICAL CRITICAL MANUFACTURING NUCLEAR REACTORS, MATERIALS, AND WASTE INFORMATION TECHNOLOGY POSTAL AND SHIPPING

Compiled by NR

Targeted Actionable Monitoring Center 2 April 2010

Page 8 of 9

THREAT / INDICATOR / WARNING RATING

DESCRIPTION
Available intelligence and recent events indicate that hostile elements currently have little capability or intent to take action against the target. It is assessed that, although it cannot be ruled out, an attack or action is unlikely to be mounted based on current available intelligence. Available intelligence and recent events indicate that hostile elements have the capability to take action against the target and that such action is within the adversary's current intent. It is assessed that an attack or action is likely to be a priority and might well be mounted. Available intelligence and recent events indicate that hostile elements have an established capability and current intent to take action against the target and there is some additional information on the nature of the threat. It is assessed that an attack or action on the target is a priority and is likely to be mounted. Available intelligence and recent events indicate that hostile elements with an established capability are actively planning to take action against the target within a matter of days (up to two weeks). An attack or action is expected imminently.

LOW (Level 4)

MODERATE (Level 3)

SEVERE (Level 2)

CRITICAL (Level 1)

Targeted Actionable Monitoring Center 2 April 2010

Page 9 of 9

END-CLASSIFIED-TAM-CFor additional information, please contact the TAM-C of the Institute of Terrorism Research and Response at: +1.215.922.1080 or info@itrrintel.org Working with organizations that refuse to surrender their domestic or international operations to terrorism
Ensure that you always receive the latest information from The Institute of Terrorism Research and Response. Add the e-mail address, "info@itrrintel.org" to your personal address book. This Intelligence report includes information from open and closed intelligence sources. Not all information is able to be verified; however, the TAM-C is actively evaluating the reporting to establish its accuracy and to determine if it represents a possible link to terrorism. If recipients have any additional or clarifying information, please contact the Targeted Actionable Monitoring Center (TAM-C) at +1.215.922.1080. Actionable Intelligence Weekly Briefing® A general overview of actionable intelligence (upcoming events) used by directors of security and law enforcement managers to pre-plan their future operations. The Briefing is dispatched on Monday of each week by 1100 GMT to enable early planning of the upcoming weeks. Threat and Hazard Monitoring (THM) A custom service meeting the needs for each client. With the assistance of our international analysts, this service identifies specific threats, hazards, vulnerabilities, and assets our team of native language speakers researchers and ground resources, are to monitor and forward on to the client. For additional information regarding the Center's services or specialized customized research and analysis programs, feel free to contact us at: info@itrrintel.org

Targeted Actionable Monitoring Center 2 April 2010

Sign up to vote on this title
UsefulNot useful